The attached patch hardens the 'updateUser' method (called by both 'manage_updateUser' and 'manage_updateUserPassword').
The attached patch hardens the 'updateUser' method (called by both 'manage_updateUser' and 'manage_ updateUserPassw ord').